Android package file
The Trojan may arrive as a package with the following characteristics:
When the Trojan is being installed, it requests permissions to perform the following actions:
- Start once the device has finished booting.
- Access information about networks.
- Read SMS messages on the device.
- Create new SMS messages.
- Send SMS messages.
- Monitor incoming SMS messages.
- Write to external storage devices.
- Check the phone's current state
- Read contact data.
- Prevent processor from sleeping or screen from dimming.
- Create new contact data.
- Allow packages to be installed or deleted.
Once installed, the application will display an icon with the text of "IBK".
Monitors for incoming SMS messages and forwards them to the following URLs:
When executed, the Trojan displays a form asking the user to enter in banking details.
Collected details are then sent to the following URL:
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":